Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warrior)

    Scheduled Pinned Locked Moved OpenVPN
    72 Posts 49 Posters 239.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rpryor
      last edited by

      right now just using xp clients and those settings did not help :o(

      i can connect to both the vpn interface of the pfsense box and its LAN ipaddress (192.168.6.45) from the laptop on the opposite end of the vpn

      i just cant ping/browse/http/telnet into any other system in the 192.168.6.0/25 and to top it off there is no log in the firewall that would suspect it of any misconfiguration

      its boggling the mind and body!

      –--------------------------------------
      got it to work, i had to change all of the gateways on the servers that i wanted to access from the vpn...that will change when i place the proxy server before the pfsense box and should just work as they are all pointing to the proxy right now

      im soooooooo flipping excited that i got all of these features for the school that i work for without paying thousands on router equipment and licensing fees!

      next step is to create batch files for the staff to auto create all of the client files so i do not get phone calls after hours trying to get them to vpn to the district applications....THANK YOU PFSENSE!

      1 Reply Last reply Reply Quote 0
      • L
        lifethetech
        last edited by

        So I've followed the instructions in this discussion, by the way great job on the howto  When I get a little more familiar I'll share too.

        Anyway this one got me stumped completely.  I'm setting up a Vista (Ultimate) roadwarrior config to a pfsense box with dual wan, opt1 wan is static, wan is dynamic
        I had issues at first with UDP, switching to TCP was helpful (proto tcp), thanks for the comments on the article guys :)

        Anyway I've done the vista workaround in the client config:

        route-method exe
        route-delay 20

        In the server client-specific configuration I specify

        route-delay 10; ns-cert-type server; route-method exe

        That being said I'm still getting this error:

        Thats even after attempting the same command myself using administrator mode of course.

        Fri Jun 13 23:34:54 2008 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.200.6/255.255.255.252 on interface {C22CAE94-9A35-48E5-B606-DEF049045B02} [DHCP-serv: 192.168.200.5, lease-time: 31536000]
        Fri Jun 13 23:34:54 2008 Successful ARP Flush on interface [22] {C22CAE94-9A35-48E5-B606-DEF049045B02}
        Fri Jun 13 23:35:05 2008 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
        Fri Jun 13 23:35:05 2008 route ADD 192.168.0.1 MASK 255.255.255.0 192.168.200.5
        The route addition failed: The parameter is incorrect.
        Fri Jun 13 23:35:05 2008 route ADD 192.168.200.1 MASK 255.255.255.255 192.168.200.5
        OK!
        Fri Jun 13 23:35:05 2008 Initialization Sequence Completed

        The thing that sticks in my mind is why just the one route ADD command that fails?

        Oh an before anyone asks I'm running the latest RC build (2.1 rc7) and running OpenVPN GUI in administrator mode

        And thats the saga, now if one of you fine gents could spare a couple minutes I'd REALLY appreciate it :)
        I'm sure its gotta be something reasonably simple that I'm just not getting.

        Thanks in advance,
        lifethetech

        1 Reply Last reply Reply Quote 0
        • W
          Wasca
          last edited by

          Does the Vista PC have UAC enabled on it?

          I enabled UAC the other day and then tried to connect to work using OpenVPN and the routes were not added. If you have UAC on try disabling it.

          1 Reply Last reply Reply Quote 0
          • L
            lifethetech
            last edited by

            I did have UAC on, but I've turned it off and tested again, no joy yet :(

            I'm still getting the same error.  Just a little more info I am on the latest release of pfsense.

            And I guess it would be pertinent to tell everyone that I'm using Vista with all the latest patches and SP1

            Thanks in advance,
            lifethetech

            EDIT: I've noticed in the openvpn pfsense logs errors related to the client specific openvpn settings:

            laptopxxxx/n.n.n.n:49393 Options error: option 'route-delay' cannot be used in this context
            laptopxxxx/n.n.n.n:49393 Options error: option 'ns-cert-type' cannot be used in this context
            laptopxxxx/n.n.n.n:49393 Options error: option 'route-method' cannot be used in this context

            with the n's being the client's IP address

            Not sure if that helps or not :)

            edit:

            A little more info, I've tried tearing down the whole setup and redoing it all then installing the client on XP here is the error from the XP box (still the same error on vista):

            The route addition failed: The specified mask parameter is invalid. (Destination & Mask) != Destination

            1 Reply Last reply Reply Quote 0
            • chpalmerC
              chpalmer
              last edited by

              Fix to the link on the original post…

              http://openvpn.net/index.php/documentation/howto.html

              :)

              Triggering snowflakes one by one..
              Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

              1 Reply Last reply Reply Quote 0
              • T
                tacfit
                last edited by

                Just for the record, I've posted a slightly modified version for my own personal records on my blog. Big thanks for the work you did here mate!

                http://www.jpuddy.net/2008/11/25/setting-up-a-road-warrior-style-vpn-connection-with-pfsense-and-openvpn/

                1 Reply Last reply Reply Quote 0
                • F
                  fastcon68
                  last edited by

                  I just got this configuration setup and getting the following errors in the logs.
                  RC

                  Dec 27 15:44:09 openvpn[11789]: Use –help for more information.
                  Dec 27 15:44:09 openvpn[11789]: Options error: Unrecognized option or missing parameter(s) in /var/etc/openvpn_server0.conf:14: lport (2.0.6)
                  Dec 27 12:59:14 openvpn[356]: Use –help for more information.
                  Dec 27 12:59:14 openvpn[356]: Options error: Unrecognized option or missing parameter(s) in /var/etc/openvpn_client0.conf:14: remote (2.0.6)
                  Dec 27 12:59:12 openvpn[354]: Use –help for more information.
                  Dec 27 12:59:12 openvpn[354]: Options error: Unrecognized option or missing parameter(s) in /var/etc/openvpn_server0.conf:14: lport (2.0.6)

                  1 Reply Last reply Reply Quote 0
                  • K
                    kangbobon
                    last edited by

                    Great Tutorial,Thanks  :)

                    1 Reply Last reply Reply Quote 0
                    • N
                      newmember
                      last edited by

                      Tried openvpn version OpenVPN 2.1_rc15 i686-pc-mingw32  and all worked fine as expected.

                      1 Reply Last reply Reply Quote 0
                      • H
                        Hugovsky
                        last edited by

                        GReat tutorial! Thankx! ;)

                        1 Reply Last reply Reply Quote 0
                        • H
                          Hugovsky
                          last edited by

                          Just one quick question: what encryption whould you use?

                          1 Reply Last reply Reply Quote 0
                          • F
                            fastcon68
                            last edited by

                            This is a awesome overview of OpenVPN.  I got it up and running in a few hours.  Once up it is now working.  I just need to make sure that I can connect to more tunnels that are avaiable.

                            RC

                            1 Reply Last reply Reply Quote 0
                            • B
                              bnasty
                              last edited by

                              Awesome guide! I got this working over TCP port 443 since we have a blanket port block here at work. If anyone else is trying to do this using TCP, remember to change the guide/defaults:

                              1. On the OpenVPN Add tab in pfSense.
                              2. On the WAN-LAN rule.
                              3. In the config file for the OVPN client install.
                              4. Change the pfSense web port from 443 to something else (4443) if using HTTPS.

                              I forgot to change the proto line in #3 from UDP to TCP, and I forgot about #4 – that wasted 20 minutes of my life.

                              1 Reply Last reply Reply Quote 0
                              • G
                                gladizxx
                                last edited by

                                Creating certificates manually on Windows (by Hernan Maslowski)
                                You can also create the keys with a Win32 program called “My Certificate
                                Wizard”: http://www.openvpn.se/mycert/

                                and tutorial easy to run

                                http://www.enterprisenetworkingplanet.com/linux_unix/article.php/3802221/Run-OpenVPN-on-Windows-Mac-and-LinuxUnix.htm…............ :o

                                1 Reply Last reply Reply Quote 0
                                • X
                                  XZed
                                  last edited by

                                  A big thank you to Frewald and tacfit for their howto !

                                  Even i hadn't compare the 2 howto to notice differences  ;D

                                  Just 2 questions (i admit, i've not searched before posting these two questions) :

                                  • Is it possible to protect the CA created locally ? i remember have read a tutorial explaining how to protect with a password (requested at each certificate creation)

                                  • Is it possible to implement the TLS-Auth ? i think have seen a package for this…

                                  Well, as i've tested, i feedback  ;D

                                  1 Reply Last reply Reply Quote 0
                                  • N
                                    nambi
                                    last edited by

                                    I would have NEVER figured this out without this tutorial.

                                    Working on a winxp machine to a PFSENSE box / network.

                                    I do have one concern in the logs on OPENVPN I see

                                    Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6080 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                    Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6080 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                    Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6078 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                    Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6077 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
                                    Sep 1 15:08:08 openvpn[39663]: ovpn_client1/99.253.209.93:3040 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6077 ] – see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

                                    I don't notice anything in particular strange in performance but this log is running continuously reporting errors.

                                    Thank You!

                                    1 Reply Last reply Reply Quote 0
                                    • X
                                      Xefan
                                      last edited by

                                      This is a great manual. It worked well for me. Thanks a lot!

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        kjurkic
                                        last edited by

                                        Sorry, but this tutorial did NOT work for me :-[

                                        after 3 tries, I printed it out and checked off the steps as I performed them (now 4th try), and even disabled the f/w on my winXP client, and still no joy.

                                        pfsense 1.2.2 which is LAN f/w, DHCP server, and openvpn gate.
                                        Winxp, SP3, latest openvpn client, firewall disabled….

                                        On the client log, this is all i get:
                                        Thu Sep 10 17:14:17 2009 OpenVPN 2.1_rc19 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Jul 16 2009
                                        Thu Sep 10 17:14:17 2009 NOTE: OpenVPN 2.1 requires '–script-security 2' or higher to call user-defined scripts or executables
                                        Thu Sep 10 17:14:17 2009 LZO compression initialized
                                        Thu Sep 10 17:14:17 2009 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
                                        Thu Sep 10 17:14:17 2009 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
                                        Thu Sep 10 17:14:17 2009 Local Options hash (VER=V4): '41690919'
                                        Thu Sep 10 17:14:17 2009 Expected Remote Options hash (VER=V4): '530fdded'
                                        Thu Sep 10 17:14:17 2009 Socket Buffers: R=[8192->8192] S=[8192->8192]
                                        Thu Sep 10 17:14:17 2009 UDPv4 link local: [undef]
                                        Thu Sep 10 17:14:17 2009 UDPv4 link remote: 142.25.56.3:1194
                                        Thu Sep 10 17:14:17 2009 TLS: Initial packet from 142.25.56.3:1194, sid=8cfa3413 d6470101
                                        Thu Sep 10 17:14:17 2009 VERIFY OK: depth=1, /C=CA/ST=BC/L=Bamfield/O=BMSC/CN=openvpnbmsc/emailAddress=admin@bms.bc.ca
                                        Thu Sep 10 17:14:17 2009 VERIFY OK: nsCertType=SERVER
                                        Thu Sep 10 17:14:17 2009 VERIFY OK: depth=0, /C=CA/ST=BC/O=BMSC/CN=server/emailAddress=admin@bms.bc.ca

                                        On this same firewall, as a test I was able to copy the certs from an older openvpn install at another org, and the client keys for same, and it DID connect, but any NEW clients created even using the older certgen, refused to work. Its all very puzzling… ???

                                        regards
                                        Ken

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          charneval
                                          last edited by

                                          how can I copy the file certificate.crt (the file in my openvpn/easy-rsa/keys) in the format x.509 insite the windows?
                                          In your guide you sayd:

                                          Now you need to have access to some of the files created in c:\programfiles\openvpn
                                          easy-rsa\keys (mentioned in #12)
                                          23) Copy the WHOLE content of ca.crt into the "CA certificate" window
                                          24) Copy the WHOLE content of server.crt into the "Server Certificate" window
                                          25) Copy the WHOLE content of server.key into the "Server Key" window
                                          26) Copy the WHOLE content of dh1024.pem into the "DH parameters" window

                                          Can you help me?

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            mnovotny
                                            last edited by

                                            Right-click on file, Open With, Notepad or something similar.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.